# Phishing sites impersonating Wells fargo PhishDestroy has recorded 17 phishing domains impersonating Wells fargo since 2025-08-09, 1 of them in the last 30 days. The most used registrars are Web Commerce Communications and Surge.sh; the most common TLDs are .com and .sh. The official Wells fargo domain is wellsfargo.com: any other site asking for your login or wallet is not Wells fargo. 17Domains, all time 1Last 30 days 8Online at last check 1Confirmed takedowns ## New domains in the last 90 days Wells fargo phishing domains detected per day: 4 from 2026-07-25 to 2026-10-22; peak 1. ## How to tell a fake Wells fargo site Official domain: wellsfargo.com. Words most often added to the brand in reported domains: fargo, connect, secure, fastlinkservicefreight, chivalrousmpr, orqwnnahu, kemixtdwnbtoyegxdmstitch, acct, homeloans, pagescdn. - Type the address yourself or use a bookmark; phishing links for Wells fargo arrive through ads, search results, direct messages and fake support accounts. - Check the full domain before you sign in: look for extra words, hyphens, a different TLD or look-alike letters. - Wells fargo does not ask you to confirm your password or card details through a link in an email or SMS. Paste a suspicious address into the [Homoglyph Checker](https://phishdestroy.io/developer-tools/homoglyph-checker) or check it against the [DestroyList](https://phishdestroy.io/developer-tools/destroylist-check). ## Latest Wells fargo phishing domains The 17 most recently detected domains impersonating Wells fargo Domain | First detected | Status at last check | Registrar | [wellsfargosecurelogin.ct.ws](https://phishdestroy.io/domain/wellsfargosecurelogin.ct.ws/) | 2026-10-02 | Online | — | [ceteris.fr](https://phishdestroy.io/domain/ceteris.fr/) | 2026-08-15 | Online | OVH | [www-connect.secure.werllsfargo.com.jmvlogistics.in](https://phishdestroy.io/domain/www-connect.secure.werllsfargo.com.jmvlogistics.in/) | 2026-08-14 | Online | GoDaddy | [sinkrone.com](https://phishdestroy.io/domain/sinkrone.com/) | 2026-08-11 | Online | Web Commerce Communications dba WebNic.c | [desk.ru.com](https://phishdestroy.io/domain/desk.ru.com/) | 2026-07-22 | Offline | Sav.com | [dashboardsecure-wfcom-webauth-overview.github.io](https://phishdestroy.io/domain/dashboardsecure-wfcom-webauth-overview.github.io/) | 2026-07-10 | Offline | GitHub | [welf2805-ffhmfsdfcaa8anav.canadacentral-01.azurewebsites.net](https://phishdestroy.io/domain/welf2805-ffhmfsdfcaa8anav.canadacentral-01.azurewebsites.net/) | 2026-06-26 | Online | Microsoft Azure | [crystal-miner.com](https://phishdestroy.io/domain/crystal-miner.com/) | 2026-06-24 | Offline | Cloudflare | [connect.secure.wellsrfargo-srv.kjlj.com](https://phishdestroy.io/domain/connect.secure.wellsrfargo-srv.kjlj.com/) | 2026-03-15 | Online | VM SINO PROFIT (HK) | [w-fargo.com](https://phishdestroy.io/domain/w-fargo.com/) | 2026-02-26 | Offline | Ligne Web Services dba LWS | [wells-fargo-rho.vercel.app](https://phishdestroy.io/domain/wells-fargo-rho.vercel.app/) | 2026-02-11 | Online | Tucows Domains | [net1f1ix.com](https://phishdestroy.io/domain/net1f1ix.com/) | 2026-01-31 | Offline | BigRock Solutions | [wefab.online](https://phishdestroy.io/domain/wefab.online/) | 2026-01-07 | Offline | Global Domain | [homeloans.wellsfargo.com.pagescdn.com](https://phishdestroy.io/domain/homeloans.wellsfargo.com.pagescdn.com/) | 2025-12-27 | Online | MarkMonitor | [0wf0acct.us](https://phishdestroy.io/domain/0wf0acct.us/) | 2025-12-22 | Offline | NameSilo | [chivalrousmpr3orqwnnahu4kemixtdwnbtoyegxdmstitch.surge.sh](https://phishdestroy.io/domain/chivalrousmpr3orqwnnahu4kemixtdwnbtoyegxdmstitch.surge.sh/) | 2025-11-01 | Taken down | Surge.sh | [fastlinkservicefreight.com](https://phishdestroy.io/domain/fastlinkservicefreight.com/) | 2025-08-09 | Offline | Web Commerce Communications | [All 17 Wells fargo reports](https://phishdestroy.io/domain/?brand=Wells fargo) ## Where they are registered and hosted ### Registrars - [Web Commerce Communications](https://phishdestroy.io/registrar/webnic/)1 - Surge.sh1 - [NameSilo](https://phishdestroy.io/registrar/namesilo/)1 - [MarkMonitor](https://phishdestroy.io/registrar/markmonitor/)1 - [Global Domain](https://phishdestroy.io/registrar/global-domain-group/)1 - BigRock Solutions1 - [Tucows Domains](https://phishdestroy.io/registrar/tucows/)1 - Ligne Web Services dba LWS1 ### Top-level domains - [.com](https://phishdestroy.io/tld/com/)8 - [.sh](https://phishdestroy.io/tld/sh/)1 - [.us](https://phishdestroy.io/tld/us/)1 - [.online](https://phishdestroy.io/tld/online/)1 - [.app](https://phishdestroy.io/tld/app/)1 - [.net](https://phishdestroy.io/tld/net/)1 - [.io](https://phishdestroy.io/tld/io/)1 - [.in](https://phishdestroy.io/tld/in/)1 ### Hosting networks - CLOUDFLARENET, US2 - MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporat2 - AS-COLOCROSSING, US1 - DIGITALOCEAN-ASN, US1 - NEWDHAKAHARDWARE-AS-AP NEW DHAKA HARDWARE, BD1 - Cogent Communications, LLC1 - AMAZON-02 - Amazon.com, Inc., US1 - LWS Groupe LWS SARL, FR1 ## Related - [Typosquatting](https://phishdestroy.io/glossary/typosquatting/) - [Homoglyph](https://phishdestroy.io/glossary/homoglyph/) - [Phishing kit](https://phishdestroy.io/glossary/phishing-kit/) - [Homoglyph Checker](https://phishdestroy.io/developer-tools/homoglyph-checker) - [Abuse Report Generator](https://phishdestroy.io/developer-tools/abuse-report-generator) - [If you already used a fake site: emergency guide](https://phishdestroy.io/critical-action) - [All impersonated brands](https://phishdestroy.io/brand/) Data: PhishDestroy domain-report database, built 2026-10-22. Counts cover every reported domain whose stored target brand is Wells fargo; share of all PhishDestroy reports: 0.01%. Canonical: https://phishdestroy.io/brand/wells-fargo/